Merge pull request #560 from Cargill/azure_signin_bad_json

Azure Interactive signin has bad json string {PII Removed}
Cargill · Nov 14, 2024 · 2040786 · 2040786
2 parents 5f0f75a + 4350535
commit 2040786
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/config/processors/event_hub_audit_azure.event_hub_interactive_signin.conf b/config/processors/event_hub_audit_azure.event_hub_interactive_signin.conf
@@ -17,7 +17,8 @@ filter {
       "message", '"\[', '[',
       "message", '\]"', ']',
       "message", '\}"', '}',
-      "message", '"\{', '{'
+      "message", '"\{', '{',
+      "message", '{PII Removed}', '"PII Removed"'
     ]
   }
    json {